---
title: "Client passports in itinerary software: a GDPR checklist"
description: "What the GDPR asks of a small travel agency and its software vendor, and what nine itinerary tools publish about hosting, DPAs, sub-processors and deletion."
url: "https://viaondo.com/blog/client-passports-itinerary-software-gdpr"
language: "en"
updated: "2026-10-13"
---

# Is it safe to keep client passports in itinerary software? What to ask before you choose

What the GDPR asks of a small travel agency and its software vendor, and what nine itinerary tools publish about hosting, DPAs, sub-processors and deletion.

- By Pablo Bravo: https://viaondo.com/blog/author/pablo-bravo
- Updated 13 October 2026
- 9 min read
- Regulation: https://viaondo.com/blog/category/regulation

## Key takeaways

- Under the GDPR your agency decides why a client’s passport details are kept, so it is the controller, and a software vendor that stores them for you is a processor that needs a written contract with you.
- No official source we found sets a fixed time for keeping a passport copy after a trip. The rule is to keep only what you need, only as long as you need it, and to set the deletion date yourself.
- On their own public pages, one of nine itinerary tools published all five data-handling points we counted, three named a European location for the data, and four offered a data processing agreement.
- Before you upload a passport, ask a vendor eight questions: where the data is stored, whether you can sign a DPA, who the sub-processors are, how deletion works, what security it applies, when it tells you about a breach, what happens at the end of the contract and whether AI reads your documents.
- We make Viaondo, one of the tools in the count. It publishes all five points, and its own limits are listed at the end.

**Short answer:** it can be, if you keep only the passport data a booking needs, delete it on a date you set, and use a vendor that signs a data processing agreement, tells you where the data is stored and says how it deletes it. The GDPR makes your agency responsible for the data even when software stores it, and most itinerary tools publish some of this information while few publish all of it.

A client’s passport is one of the documents an agency holds, so this guide gives you the rules in plain terms, then what nine tools say on their own pages, then the questions to ask before you upload anything. The key takeaways above give the summary, and the sections below give the rules and the evidence. It is a checklist, not legal advice.

## What does the GDPR ask of an agency that holds a client’s passport?

It asks three things of you: have a lawful reason, collect only what you need, and keep it only as long as you need it. The EDPB’s guide for small businesses says an organization can only process personal data that is “necessary and proportionate” to its purpose, and that storage “must be limited in time” ([EDPB, data protection basics](https://www.edpb.europa.eu/sme/learn-the-basics/data-protection-basics_en)).

Those are the principles in Article 5 of the [GDPR](https://eur-lex.europa.eu/eli/reg/2016/679/oj), where data minimization is point 5(1)(c) and storage limitation is point 5(1)(e). Italy’s data authority lists the same principles, together with lawfulness, fairness and transparency, in its [clarification note on identity documents](https://www.garanteprivacy.it/home/docweb/-/docweb-display/docweb/10244289), which it cites together with a press release of 29 April 2026. In practice, you should write down for each document why you hold it, which supplier needs it and when it will be deleted.

## Who is responsible for the data, you or the software vendor?

You are. An agency that decides why and how client data is used is the data controller, and the EDPB’s guide says that a small business in that position is the controller ([EDPB FAQ](https://www.edpb.europa.eu/sme/find-practical-info/faq_en)). The European Commission describes the processor as the party that “processes personal data only on behalf of the controller” ([European Commission](https://commission.europa.eu/law/law-topic/data-protection/information-business-and-organisations/application-gdpr_en)), which is what an itinerary tool that stores your clients’ details does.

**A data controller** is the person or organization that decides why and how personal data is used, and **a data processor** is one that handles it on the controller’s behalf. **A data processing agreement (DPA)** is the written contract between the two. The EDPB says the relationship “must be governed by a contract” documenting the processing, and its FAQ, linked above, calls a valid contract “obligatory”. Article 28 of the GDPR adds that the processor acts only on your documented instructions, that it deletes or returns the data when the service ends, and that the contract is in writing, electronic form included.

## How much of a passport do you need to keep?

Often less than a copy. The Spanish data authority (AEPD) said in June 2025 that requesting a copy of a national ID or passport at accommodation breaches data minimization under Article 5(1)(c) ([AEPD note, PDF](https://www.aepd.es/guias/nota-aepd-registro-hospedajes.pdf)). Italy’s Garante said in April 2026 that hotels must erase copies of guests’ documents once the data has gone to the public security authorities, keeping only the transmission receipt ([Garante press release](https://www.garanteprivacy.it/home/docweb/-/docweb-display/docweb/10244195)).

Both statements concern accommodation providers, not travel agencies, and neither mentions agencies. No official guidance written for agencies turned up in the sources listed. The principle is the same GDPR article, though, so ask what each booking needs: a name as it appears in the passport, a number and an expiry date are not the same as a scan. If you only need to check dates, the [passport validity checker](https://viaondo.com/tools/passport-validity-checker) asks only for the expiry and trip dates.

## How long can you keep a passport copy after the trip?

No source we checked gives a fixed period. The EDPB tells small businesses to “delete individuals’ personal data when no longer necessary”, and notes that national law may oblige you to keep certain data, “for tax reasons” for example (same EDPB guide). The retention period is yours to set and defend.

A workable rule is to delete passport copies a short, fixed time after the trip ends and to keep only the dates and numbers that a supplier or a legal duty still requires. Do not keep copies “in case the client travels again”, because asking the client again takes one message. Check also that your software can enforce the rule for you, since a tool that only lets you delete a document by hand relies on someone remembering, while a tool that deletes automatically after the trip does not.

## What must the software do to keep passport data secure, and what if there is a breach?

It must apply security “appropriate to the risk”, and so must you. Article 32 of the GDPR puts that duty on both the controller and the processor ([EDPB, secure personal data](https://www.edpb.europa.eu/sme/be-compliant/secure-personal-data_en)). Article 33 gives you, as controller, 72 hours after becoming aware of a breach to notify the supervisory authority, unless it is unlikely to result in a risk to individuals, and you must document every breach ([EDPB, data breaches](https://www.edpb.europa.eu/sme/assess-the-risks/data-breaches_en)).

Under Article 33(2) a processor must tell the controller “without undue delay”, but your 72 hours still run from the moment you become aware. A vendor’s speed therefore matters: look for a stated deadline in its DPA or security page.

## What do nine itinerary tools publish about client data?

On their own public pages, one of nine tools published all five points we counted: TravelJoy. Eight named where data is stored, but only three named a location in Europe. Four offered a DPA to customers, four listed sub-processors by name, seven said how documents are deleted or kept, and seven described at least one security measure.

| Tool | Data location | DPA | Sub-processors | Deletion | Security |
|---|---|---|---|---|---|
| [Travefy](https://travefy.com/company/terms-of-use-privacy-policy) | United States | Yes | — | Yes | Yes |
| [TravelJoy](https://traveljoy.com/sub_processors) | United States | Yes | Yes | Yes | Yes |
| [Tern](https://tern.travel/privacy) | United States | — | — | Yes | Yes |
| [Axus](https://axustravelapp.com/policies/privacy) | United States | — | Yes | Yes | Yes |
| [Vamoos](https://www.vamoos.com/privacy-policy/) | — | — | Yes | — | — |
| [MOGU](https://moguplatform.com/en/legal/politica-de-seguridad) | Europe (Belgium) | Yes | — | — | Yes |
| [Safari Portal](https://www.safariportal.app/privacy-policy) | United States | — | — | Yes | Yes |
| [Wetu](https://wetu.com/privacy-notice/wts-privacy-notice) | Europe | Yes | — | Yes | — |
| [mTrip](https://www.mtrip.com/knowledge-base/security-and-data-privacy-overview/) | Germany for European clients | — | Yes | Yes | Yes |
| **Total of nine** | 8 | 4 | 4 | 7 | 7 |

How to read the table: a dash means no statement was found on the pages opened, not that the vendor does not do it.

## How did we count, and what are the limits?

We counted on 11 October 2026 with rules written before we opened the pages; two borderline cells are explained below. A tool scores a point only if a page on its own domain says it:

1. **Location:** names the country or region where customer data is stored.
2. **DPA:** says a data processing agreement is available to customers, or publishes one.
3. **Sub-processors:** names the providers that process data on its behalf.
4. **Deletion:** says how long client documents are kept or how to delete them.
5. **Security:** describes at least one concrete measure, such as encryption or two-factor authentication.

Vamoos’s sub-processor point is the weakest, a privacy-policy line naming three third-party services. Wetu’s terms (version 1, section 14) contain an Article 28 processor clause, so we counted them as a DPA. Its only concrete security statement sits in the DPA of a separate product, Wetu Analytics, so we did not count that point. mTrip’s sub-processor page says its DPA with OpenAI is available on request. That is an agreement with a sub-processor, so we did not count it as a DPA offered to customers. Counting it would raise the DPA total from 4 to 5.

The limits of the count: it reads public pages as of one day, not contracts or security practice. A vendor may offer a DPA on request that it does not advertise. We make Viaondo, which is not in the nine, and we checked it against our own legal pages: it meets all five (see below).

## Which questions should you ask a vendor before you upload a passport?

Ask eight, and expect a written answer to each. None of the nine vendor pages we read tells small agencies how to evaluate a vendor, so this list is ours, built on the GDPR points above.

1. **Where is client data stored?** Ask for the country, and whether support or AI features process it elsewhere.
2. **Can I sign a DPA?** It should say it acts only on your instructions and deletes or returns the data when the service ends.
3. **Who are the sub-processors?** A named list, with their locations and how changes are announced.
4. **How are documents deleted?** Automatically after the trip, or by hand? Can you delete one client’s file?
5. **What security applies?** Encryption in transit, access limited per agency, links that can be revoked.
6. **How fast will you tell me about a breach?** A number of hours, in writing.
7. **What happens when I cancel?** Export and deletion, with a deadline.
8. **Does AI read my documents?** Which provider, where it runs, and whether it keeps the documents.

The same advice applies to the way clients send you documents, because a passport scan sent by plain email or a chat message sits in several inboxes you do not control. Under Article 32 your security has to match the risk and an ID document is a high-value target, so use the upload form or secure link of your software where there is one.

## What does Viaondo publish, and where does it fall short?

We make Viaondo, so check our claims on the pages we link. [Viaondo’s DPA](https://viaondo.com/legal/dpa) is a data processing agreement under Article 28 of the GDPR, included with the plan on the [pricing page](https://viaondo.com/pricing). Its [sub-processor list](https://viaondo.com/legal/subprocessors) names Cloudflare (application hosting on its worldwide network, and database and private file storage under European Union jurisdiction), NaN (AI features, European Union) and Stripe (billing only).

For passports, the [privacy policy](https://viaondo.com/legal/privacy) says passport copies and other trip documents are deleted 30 days after the trip ends. The DPA commits Viaondo to tell you about a breach without undue delay and, where feasible, within 72 hours. It lists its security measures, among them private file storage with no public addresses, trip links of 256 random bits of which only a hash is stored, and links you can revoke.

The limits matter as much. Stripe may transfer billing data to the United States, and three Cloudflare services (the application itself, email delivery and the sign-in bot check) run on its worldwide network. The app cannot delete a copy that a traveler already saved offline until the phone next connects, and the DPA says the service is not designed for special-category data such as health records. The rule of “30 days after the trip” is also Viaondo’s own and may not be yours, so check it against the retention period you set. See how documents work in the [traveler app](https://viaondo.com/product/traveler-app) and, if you work alone, read the page for [independent travel advisors](https://viaondo.com/for/independent-travel-advisors).

## How this guide was checked

Every rule comes from EUR-Lex, the EDPB, the European Commission, the AEPD or the Garante, and every vendor fact from that vendor’s own pages, all opened on 11 October 2026. Each rule and vendor fact was checked against those sources on 11 October 2026, in an editorial fact-check by claim. This is general information, not legal advice. If you find a statement that is out of date, [contact us](https://viaondo.com/contact), and you can read more about us on the [about page](https://viaondo.com/about). For the wider choice of tool, see the [comparison of ten itinerary tools](https://viaondo.com/itinerary-software-for-travel-agencies).

## Sources

- [EUR-Lex: Regulation (EU) 2016/679 (GDPR), Articles 5, 28, 32 and 33](https://eur-lex.europa.eu/eli/reg/2016/679/oj) (accessed 11 October 2026)
- [EDPB: Data protection basics (guide for small business)](https://www.edpb.europa.eu/sme/learn-the-basics/data-protection-basics_en) (accessed 11 October 2026)
- [EDPB: Data controller or data processor](https://www.edpb.europa.eu/sme/learn-the-basics/data-controller-or-data-processor_en) (accessed 11 October 2026)
- [EDPB: Secure personal data](https://www.edpb.europa.eu/sme/be-compliant/secure-personal-data_en) (accessed 11 October 2026)
- [EDPB: Data breaches](https://www.edpb.europa.eu/sme/assess-the-risks/data-breaches_en) (accessed 11 October 2026)
- [EDPB: Frequently asked questions (guide for small business)](https://www.edpb.europa.eu/sme/find-practical-info/faq_en) (accessed 11 October 2026)
- [European Commission: Application of the GDPR (controller and processor)](https://commission.europa.eu/law/law-topic/data-protection/information-business-and-organisations/application-gdpr_en) (accessed 11 October 2026)
- [AEPD: note on requesting copies of identity documents in accommodation (17 June 2025, PDF)](https://www.aepd.es/guias/nota-aepd-registro-hospedajes.pdf) (accessed 11 October 2026)
- [Garante per la protezione dei dati personali: press release on hotels and copies of guests’ documents (29 April 2026)](https://www.garanteprivacy.it/home/docweb/-/docweb-display/docweb/10244195) (accessed 11 October 2026)
- [Garante per la protezione dei dati personali: clarification note on guests’ identity documents (undated; cited with the press release of 29 April 2026)](https://www.garanteprivacy.it/home/docweb/-/docweb-display/docweb/10244289) (accessed 11 October 2026)
- [Travefy: homepage (FAQ on security)](https://travefy.com/) (accessed 11 October 2026)
- [Travefy: Terms of use and privacy policy, with its Data Processing Addendum](https://travefy.com/company/terms-of-use-privacy-policy) (accessed 11 October 2026)
- [TravelJoy: Privacy](https://traveljoy.com/privacy) (accessed 11 October 2026)
- [TravelJoy: Sub-processors](https://traveljoy.com/sub_processors) (accessed 11 October 2026)
- [TravelJoy help: Collect and store client passport photos](https://help.traveljoy.com/hc/en-us/articles/360047051511-Collect-and-store-client-passport-photos) (accessed 11 October 2026)
- [Tern: Privacy policy](https://tern.travel/privacy) (accessed 11 October 2026)
- [Tern help: Data privacy and security in Tern](https://help.tern.travel/en/articles/8126635-data-privacy-and-security-in-tern) (accessed 11 October 2026)
- [Axus Travel App: Privacy policy](https://axustravelapp.com/policies/privacy) (accessed 11 October 2026)
- [Vamoos: Privacy policy](https://www.vamoos.com/privacy-policy/) (accessed 11 October 2026)
- [MOGU: Security policy](https://moguplatform.com/en/legal/politica-de-seguridad) (accessed 11 October 2026)
- [MOGU: Privacy policy](https://moguplatform.com/en/legal/politica-de-privacidad) (accessed 11 October 2026)
- [Safari Portal: Privacy policy](https://www.safariportal.app/privacy-policy) (accessed 11 October 2026)
- [Safari Portal: Travel portal privacy policy](https://www.safariportal.app/travel-portal-privacy-policy) (accessed 11 October 2026)
- [Wetu: WTS privacy notice](https://wetu.com/privacy-notice/wts-privacy-notice) (accessed 11 October 2026)
- [Wetu: Terms and conditions (v1)](https://wetu.com/terms-conditions/terms-conditions-v1) (accessed 11 October 2026)
- [Wetu Analytics: Data Processing Agreement](https://analytics.wetu.com/terms/dpa) (accessed 11 October 2026)
- [mTrip: Security and data privacy overview](https://www.mtrip.com/knowledge-base/security-and-data-privacy-overview/) (accessed 11 October 2026)
- [mTrip: Sub-processors](https://www.mtrip.com/knowledge-base/sub-processors/) (accessed 11 October 2026)
- [mTrip: Privacy](https://www.mtrip.com/en/privacy/) (accessed 11 October 2026)
- [Viaondo: Data processing agreement](https://viaondo.com/legal/dpa) (accessed 11 October 2026)
- [Viaondo: Sub-processors](https://viaondo.com/legal/subprocessors) (accessed 11 October 2026)
- [Viaondo: Privacy policy](https://viaondo.com/legal/privacy) (accessed 11 October 2026)

## Frequently asked questions

### Is it legal for a travel agency to keep a copy of a client’s passport?

The GDPR does not ban it, but it limits it: personal data must be limited to what is necessary and kept no longer than necessary. We found no official rule for travel agencies on passport copies. The closest official statements, from Spain’s and Italy’s data authorities, concern hotels and say copies of identity documents should not be requested or kept beyond the legal registration.

### Do I need a data processing agreement with my itinerary software?

Yes, if the vendor stores or handles your clients’ personal data on your behalf. The EDPB’s guide for small businesses says a contract between controller and processor is obligatory, and Article 28 of the GDPR requires it in writing, including in electronic form.

### How long can I keep a client’s passport details after the trip?

There is no fixed period in the sources we checked. The EDPB tells small businesses to delete personal data when it is no longer necessary, bearing in mind that national law may require you to keep some data, for example for tax. Decide a deletion date for each document type and write it down.

### What do I have to do if client passport data leaks?

As the controller you must notify your data protection authority within 72 hours of becoming aware of the breach, unless it is unlikely to result in a risk to individuals, and you must document every breach (GDPR Articles 33(1) and 33(5)). Ask your vendor how quickly it will tell you.